CVE-2021-22555-PipeVersion

CVE-2021-22555 versão pipe Usando pipe-primitive para explorar CVE-2021-22555, então não é necessário vazamento de kaslr nem bypass de smap smep ktpi : P: O que é pipe-primitive? R: https://github.com/veritas501/pipe-primitive Testado tanto no Linux 4.15 quanto no Linux 5.8...

CVE-2022-25636-PipeVersion

إصدار الأنبوب CVE-2022-25636 استخدام pipe-primitive لاستغلال CVE-2022-25636، لذلك لا حاجة لتسريب kaslr أو تجاوز smap smep ktpi : س: ما هو pipe-primitive؟ ج: https://github.com/veritas501/pipe-primitive...

CVE-2022-0185-PipeVersion

Versão pipe do CVE-2022-0185 Usando pipe-primitive para explorar CVE-2022-0185, então não é necessário vazamento de kaslr nem bypass de smap smep ktpi : P: O que é pipe-primitive? R: https://github.com/veritas501/pipe-primitive...

CVE-2019-1215

CVE-20190-1215 ws2ifsl.sys UAF-Exploit für Windows 10 19H1 x64 Dieser Exploit verwendet die kürzlich gepatchte Use-After-Free-Schwachstelle CVE-2019-1215 in ws2ifsl.sys, um eine lokale Privilegienausweitung zu erreichen. Der Exploit zielt auf Windows 10 19H1 1901 x64 ab und zeigt, wie kASLR, kCFG...

nullmap

nullmap Un mappatore di driver manuale molto semplice basato sul mio vecchio voidmap e sul POC per CVE-2023-21768 di chompie e b33f. Poiché la primitiva di lettura/scrittura della memoria di post-sfruttamento di IoRing non gestisce molto bene molte letture e scritture consecutive, ho deciso di...

exploiting-cve-2017-5123

Sfruttare CVE-2017-5123 Introduzione Questo repository è un'aggiunta all'articolo pubblicato su MISC Magazine 96. Siamo riusciti ad elevare i nostri privilegi in modo affidabile, sulla nostra macchina virtuale con SMEP/SMAP e KASLR abilitati. Va comunque notato che il sistema viene lasciato in un...

CTT-NFS-Vortex-RCE

CTT-NFS-Vortex-RCE CVE-2026-21509 ⚠️ Technisches Advisory: New Physics Disclosure Dieses Repository enthält einen vollständig ausgereiften Exploit für CVE-2026-21509 , der den Windows Network File System NFSv4.1 Kernel-Mode-Treiber nfssvr.sys angreift. Im Gegensatz zu standardmäßigen PoCs, die auf...

voidmap

voidmap Un semplice driver manual mapper che sfrutta CVE-2021-40449 per eseguire una funzione arbitraria a un indirizzo specifico con un singolo argomento fornito. Si basa su un exploit PoC CallbackHell. Testato su Windows 10 Pro For Workstations 1809 17763.379 64-bit, ma realisticamente dovrebbe...

SdoKeyCrypt-sys-local-privilege-elevation

SdoKeyCrypt.sys - Vulnérabilité d'élévation de privilèges locale 1. Qu'est-ce que SdoKeyCrypt.sys ? SdoKeyCrypt.sys est un pilote de protection du clavier pour un MMORPG, aka jeu de rôle en ligne massivement multijoueur, appelé MapleStory Online qui est publié par Shanda Group en Chine. Site web...

CVE-2017-5123

CVE-2017-5123 PoC CVE-2017-5123 - LPE - Umgehung von SMEP/SMAP. Kein KASLR Die waitid-Implementierung in Upstream-Kernels hat das Ziel, auf das die Ergebnisinformationen kopiert werden, nicht eingeschränkt. Dies kann es lokalen Benutzern ermöglichen, in geschützten Kernel-Speicher zu schreiben, w...

CVE-2021-21551

PoC per CVE-2021-21551 LPE di Windows che utilizza il driver Dell dbutil23.sys. Approccio dell'exploit Implementa lettura/scrittura, alloca shellcode, capovolgi la pagina per bypassare smep, sovrascrivi il puntatore haldispatch, esegui shellcode...

CVE-2017-5123

CVE-2017-5123 Exploit per la vulnerabilità del kernel CVE-2017-5123 Puoi compilarlo con: gcc -static -Wall -Wextra -Werror -o cve20175123 CVE-2017-5123.c Se vuoi ulteriori spiegazioni, ho scritto un articolo che spiega come funziona, lo puoi trovare qui Questo exploit è più affidabile del...

Exploit for CVE-2025-8061

Lenovo-CVE-2025-8061 PoC fo...

Linux Distros Unpatched Vulnerability : CVE-2016-9644

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - The getuserasmex macro in arch/x86/include/asm/uaccess.h in the Linux kernel 4.4.22 through 4.4.28 contains extended asm statements that are incompatible with t...

AMD SMM Supervisor Vulnerability Security Notice

Bulletin ID: AMD-SB-7011 Potential Impact: Loss of confidentiality, integrity, and availability Severity: High Summary External researchers reported a potential vulnerability during SMM Supervisor initialization which may impact some AMD processors. On systems that do not have Supervisor Mode...

x86: speculative vulnerability in 32bit SYSCALL path

ISSUE DESCRIPTION Due to an oversight in the very original Spectre/Meltdown security work XSA-254, one entrypath performs its speculation-safety actions too late. In some configurations, there is an unprotected RET instruction which can be attacked with a variety of speculative attacks. IMPACT An...

SUSE CVE-2016-9644

The getuserasmex macro in arch/x86/include/asm/uaccess.h in the Linux kernel 4.4.22 through 4.4.28 contains extended asm statements that are incompatible with the exception table, which allows local users to obtain root access on non-SMEP platforms via a crafted application. NOTE: this...

x86: Multiple speculative security issues

ISSUE DESCRIPTION 1 Researchers have discovered that on some AMD CPUs, the implementation of IBPB Indirect Branch Prediction Barrier does not behave according to the specification. Specifically, IBPB fails to properly flush the RAS Return Address Stack, also RSB - Return Stack Buffer - in Intel...

CVE-2022-0002

A flaw was found in hw. The Intra-mode BTI refers to a variant of Branch Target Injection aka SpectreV2 BTI where an indirect branch speculates to an aliased predictor entry for a different indirect branch in the same predictor mode, and a disclosure gadget at the predicted target transiently...

CVE-2022-0001

A flaw was found in hw. The Branch History Injection BHI describes a specific form of intra-mode BTI. This flaw allows an unprivileged attacker to manipulate the branch history before transitioning to supervisor or VMX root mode. This issue is an effort to cause an indirect branch predictor to...